AI Agents for Server Automation (Codex, Claude Code, OpenCode)

Connect Codex CLI, Claude Code, OpenCode, or any MCP-compatible AI agent to Tempest so it can operate your SSH servers for you — no shell scripts, just plain-English requests.

Tempest can hand a full SSH terminal to any AI coding agent you already use — Claude Code, Codex CLI, OpenCode, and others. Point it at your saved servers, describe what you want in plain English, and the agent opens the connection, runs the commands, reads the screen, and reports back — including driving interactive tools like htop or vim, not just one-shot commands.

No shell scripts. No Ansible playbook for a one-off task. Just describe what you want.

Enabling it

This works through Tempest's built-in MCP server, which any of these agents can connect to. Turning it on takes one command or a short config snippet, depending on which agent you use — see Install Tempest MCP Server in Claude Code, Codex, Cursor & More for the exact steps for your client.

Once it's connected, confirm it's working by asking the agent:

List my saved SSH servers.

If it comes back with your saved hosts, you're ready to go.

Your SSH credentials never leave your device — the agent only ever sees server names and terminal output, never passwords or private keys.

What you can ask it to do

Check disk usage across all your servers

List my saved SSH servers, connect to each one, run df -h, and give me a table of filesystem usage. Flag any filesystem over 80%.

The agent connects to each host in turn, runs the check, and comes back with a summary table — no need to open a dozen tabs yourself.

Restart a failing service

SSH into my web-01 server and restart the nginx service. Show me the journal output after restart and confirm it's running.

It connects, restarts the service, pulls the recent logs, and tells you whether it came back healthy.

Investigate a full disk

My db-02 server is reporting a full disk. SSH in and find what's taking up space under /var.

The agent runs the investigation, drills into the largest directories, and proposes what's safe to clean up — without you touching a terminal.

Drive an interactive tool

Open htop on my dev server and tell me which process is consuming the most CPU right now.

The agent can open full-screen terminal programs like htop or vim, read what's actually rendered on screen — process lists, gauges, menus — and summarize it for you in plain language.

Roll out a change across a group of servers

Update /etc/sysctl.conf on all my "production" group servers to set net.core.somaxconn=4096, then reload without rebooting.

It works through the group one host at a time, applies the change, and reports back which servers succeeded.

Tips for writing effective prompts

Name your servers clearly. The agent picks hosts by name, so db-primary-us-east is easier for it (and you) to reason about than srv-04.

Prefer your saved servers over typing credentials into the chat. Saved hosts keep your credentials out of the conversation entirely — they're decrypted locally from your vault. If you ask the agent to connect with a password typed inline instead, that password will be visible in the conversation.

Ask the agent to clean up when it's done. A closing note like "disconnect all sessions when finished" keeps things tidy.

For long-running commands, tell the agent to give it time: "Run the backup script and give it 60 seconds before checking the output."

Keeping an eye on what it does

Most agent CLIs show you what the agent is about to run before it executes — Codex CLI's approval policy, Claude Code's confirmation prompt, Cursor's per-action approval. Review those, especially before approving anything destructive (rm, systemctl stop, DROP TABLE, and the like). For the fuller picture on credential handling and connection security, see the Security notes in the installation guide and Reset Your Tempest Password for vault key rotation.